Re: [PacketFence-users] Issues with PacketFence Captive Portal configuration

[Nicholas P. <09...@gm...>]

Hi Ivan,

I think this is mostly likely a configuration issue. It sounds like you may
be expecting the controller to receive information about the captive
portal. This may be possible, but it's not how I've deployed packetfence in
the past. Instead, Radius and DNS do most of the work I've only worked with
7.x controller code and don't know what's changed since... however the
typical workflow I've experienced is as follows:


   - User connects to SSID and is sent to registration VLAN if their node
   isn't pre-registered. If the node has been registered, the go immediately
   to the VLAN associated with their role and this flow stops.
   - If they're sent to the registation VLAN:
      - Packetfence provides DHCP and DNS for registration VLAN.
      - DNS queries from the client are leveraged to redirect them to
      packetfence for captive portal. Most modern browsers and OSs
should do this
      automatically.
      - If the user successfully authenticates, packetfence sends a radius
      message back to the controller to change their VLAN and place them on a
      different subnet.
      - Client obtains a new lease and can access the network.


I don't know much about your setup, but if its not routed, and clients are
placed on the same vlan as packetfence (not a routed deployment). Are you
leveraging packetfence for DHCP and DNS on the registration VLAN?

Best wishes,

*Nicholas P. Pier*
Network & Virtualization Engineer
*CCNP RS, PCSNSE7, VCIX6-DCV, VCIX6-NV*


On Sat, Jun 8, 2019 at 7:45 PM Ivan Saliu via PacketFence-users <
pac...@li...> wrote:

> Hello Guys,
>
>
>
> I’m experiencing a lot of issues in configuring PacketFence’s Captive
> Portal (Version 9.0.1) with Cisco’s WLC (5508, software version 8.1).
>
> Basically I’ve tried to deploy the solution in two ways:
>
>
>
> -          The “Network Guide” one, where there is only 1 VLAN with ACLs
> on the WLC to permit only traffic to DHCP/DNS servers and PacketFence
> Portal. The issue here is the fact that the redirection does not work at
> all. The Radius parameter with the URL redirection is not filled with data
> and so the WLC doesn’t redirect at all the traffic. This is an issue
> because I do not like the user experience, since being force to type an URL
> to log in and register the device is not good.
>
> -          The second type of deployment I’ve tried to do is an interface
> in Registration mode, on a dedicated VLAN managed entirely by PacketFence,
> trying to use the VLAN change to grant internet access. In this case the
> Captive Portal works fine, but once I log into it is not recognized
> internet access and I get an error saying that internet access cannot be
> validated. If I try to disconnect the client and reconnect it, the VLAN is
> changed properly and everything works fine, but again this is not a good
> user experience and I cannot put in a production environment something that
> doesn’t work properly. This would also be my preferred solution since it
> grants the best approach to security of course since I would be able to
> isolate the Registration VLAN and then with Access-List prohibit access to
> corporate network once the client in registered.
>
>
>
> Do you have any idea on how to solve these issues? I do think it is most
> likely a misconfiguration on PacketFence or maybe I’m trying to implement
> something that it is not supported by Cisco with its WLC?!
>
>
>
> Any help on this would be greatly appreciated,
>
> Ivan
> _______________________________________________
> PacketFence-users mailing list
> Pac...@li...
> https://lists.sourceforge.net/lists/listinfo/packetfence-users
>